[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Xen-changelog] [xen stable-4.6] x86/spec_ctrl: Updates to retpoline-safety decision making



commit 916ef0dce5d010942de22a0a9479347ed4fa58d8
Author:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
AuthorDate: Fri May 18 13:31:33 2018 +0200
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Fri May 18 13:31:33 2018 +0200

    x86/spec_ctrl: Updates to retpoline-safety decision making
    
    All of this is as recommended by the Intel whitepaper:
    
    
https://software.intel.com/sites/default/files/managed/1d/46/Retpoline-A-Branch-Target-Injection-Mitigation.pdf
    
    The 'RSB Alternative' bit in MSR_ARCH_CAPABILITIES may be set by a 
hypervisor
    to indicate that the virtual machine may migrate to a processor which isn't
    retpoline-safe.  Introduce a shortened name (to reduce code volume), treat 
it
    as authorative in retpoline_safe(), and print its value along with the other
    ARCH_CAPS bits.
    
    The exact processor models which do have RSB semantics which fall back to 
BTB
    predictions are enumerated, and include Kabylake and Coffeelake.  Leave a
    printk() in the default case to help identify cases which aren't covered.
    
    The exact microcode versions from Broadwell RSB-safety are taken from the
    referenced microcode update file (adjusting for the known-bad microcode
    versions).  Despite the exact wording of the text, it is only Broadwell
    processors which need a microcode check.
    
    In practice, this means that all Broadwell hardware with up-to-date 
microcode
    will use retpoline in preference to IBRS, which will be a performance
    improvement for desktop and server systems which would previously always opt
    for IBRS over retpoline.
    
    Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx>
    
    x86/spec_ctrl: Fix typo in ARCH_CAPS decode
    
    Reported-by: Konrad Rzeszutek Wilk <konrad.wilk@xxxxxxxxxx>
    Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Acked-by: Jan Beulich <jbeulich@xxxxxxxx>
    master commit: 1232378bd2fef45f613db049b33852fdf84d7ddf
    master date: 2018-04-19 17:28:23 +0100
    master commit: 27170adb54a558e11defcd51989326a9beb95afe
    master date: 2018-04-24 13:34:12 +0100
---
 xen/arch/x86/spec_ctrl.c         | 65 ++++++++++++++++++++++++++++++++--------
 xen/include/asm-x86/cpufeature.h |  1 +
 xen/include/asm-x86/msr-index.h  |  3 ++
 3 files changed, 56 insertions(+), 13 deletions(-)

diff --git a/xen/arch/x86/spec_ctrl.c b/xen/arch/x86/spec_ctrl.c
index f119417925..1621c1765d 100644
--- a/xen/arch/x86/spec_ctrl.c
+++ b/xen/arch/x86/spec_ctrl.c
@@ -21,7 +21,7 @@
 #include <xen/lib.h>
 
 #include <asm/microcode.h>
-#include <asm/msr-index.h>
+#include <asm/msr.h>
 #include <asm/processor.h>
 #include <asm/spec_ctrl.h>
 #include <asm/spec_ctrl_asm.h>
@@ -84,23 +84,26 @@ custom_param("bti", parse_bti);
 static void __init print_details(enum ind_thunk thunk)
 {
     unsigned int _7d0 = 0, e8b = 0, tmp;
+    uint64_t caps = 0;
 
     /* Collect diagnostics about available mitigations. */
     if ( boot_cpu_data.cpuid_level >= 7 )
         cpuid_count(7, 0, &tmp, &tmp, &tmp, &_7d0);
     if ( boot_cpu_data.extended_cpuid_level >= 0x80000008 )
         cpuid(0x80000008, &tmp, &e8b, &tmp, &tmp);
+    if ( _7d0 & cpufeat_mask(X86_FEATURE_ARCH_CAPS) )
+        rdmsrl(MSR_ARCH_CAPABILITIES, caps);
 
     printk(XENLOG_DEBUG "Speculative mitigation facilities:\n");
 
     /* Hardware features which pertain to speculative mitigations. */
-    if ( (_7d0 & (cpufeat_mask(X86_FEATURE_IBRSB) |
-                  cpufeat_mask(X86_FEATURE_STIBP))) ||
-         (e8b & cpufeat_mask(X86_FEATURE_IBPB)) )
-        printk(XENLOG_DEBUG "  Hardware features:%s%s%s\n",
-               (_7d0 & cpufeat_mask(X86_FEATURE_IBRSB)) ? " IBRS/IBPB" : "",
-               (_7d0 & cpufeat_mask(X86_FEATURE_STIBP)) ? " STIBP"     : "",
-               (e8b  & cpufeat_mask(X86_FEATURE_IBPB))  ? " IBPB"      : "");
+    printk(XENLOG_DEBUG "  Hardware features:%s%s%s%s%s%s\n",
+           (_7d0 & cpufeat_mask(X86_FEATURE_IBRSB)) ? " IBRS/IBPB" : "",
+           (_7d0 & cpufeat_mask(X86_FEATURE_STIBP)) ? " STIBP"     : "",
+           (e8b  & cpufeat_mask(X86_FEATURE_IBPB))  ? " IBPB"      : "",
+           (caps & ARCH_CAPABILITIES_IBRS_ALL)      ? " IBRS_ALL"  : "",
+           (caps & ARCH_CAPABILITIES_RDCL_NO)       ? " RDCL_NO"   : "",
+           (caps & ARCH_CAPS_RSBA)                  ? " RSBA"      : "");
 
     /* Compiled-in support which pertains to BTI mitigations. */
 #ifdef CONFIG_INDIRECT_THUNK
@@ -132,6 +135,20 @@ static bool_t __init __maybe_unused retpoline_safe(void)
          boot_cpu_data.x86 != 6 )
         return 0;
 
+    if ( boot_cpu_has(X86_FEATURE_ARCH_CAPS) )
+    {
+        uint64_t caps;
+
+        rdmsrl(MSR_ARCH_CAPABILITIES, caps);
+
+        /*
+         * RBSA may be set by a hypervisor to indicate that we may move to a
+         * processor which isn't retpoline-safe.
+         */
+        if ( caps & ARCH_CAPS_RSBA )
+            return 0;
+    }
+
     switch ( boot_cpu_data.x86_model )
     {
     case 0x17: /* Penryn */
@@ -158,18 +175,40 @@ static bool_t __init __maybe_unused retpoline_safe(void)
          * versions.
          */
     case 0x3d: /* Broadwell */
-        return ucode_rev >= 0x28;
+        return ucode_rev >= 0x2a;
     case 0x47: /* Broadwell H */
-        return ucode_rev >= 0x1b;
+        return ucode_rev >= 0x1d;
     case 0x4f: /* Broadwell EP/EX */
-        return ucode_rev >= 0xb000025;
+        return ucode_rev >= 0xb000021;
     case 0x56: /* Broadwell D */
-        return 0; /* TBD. */
+        switch ( boot_cpu_data.x86_mask )
+        {
+        case 2:  return ucode_rev >= 0x15;
+        case 3:  return ucode_rev >= 0x7000012;
+        case 4:  return ucode_rev >= 0xf000011;
+        case 5:  return ucode_rev >= 0xe000009;
+        default:
+            printk("Unrecognised CPU stepping %#x - assuming not reptpoline 
safe\n",
+                   boot_cpu_data.x86_mask);
+            return 0;
+        }
+        break;
 
         /*
-         * Skylake and later processors are not retpoline-safe.
+         * Skylake, Kabylake and Cannonlake processors are not retpoline-safe.
          */
+    case 0x4e:
+    case 0x55:
+    case 0x5e:
+    case 0x66:
+    case 0x67:
+    case 0x8e:
+    case 0x9e:
+        return 0;
+
     default:
+        printk("Unrecognised CPU model %#x - assuming not reptpoline safe\n",
+               boot_cpu_data.x86_model);
         return 0;
     }
 }
diff --git a/xen/include/asm-x86/cpufeature.h b/xen/include/asm-x86/cpufeature.h
index ad47365d2f..82ad43f18c 100644
--- a/xen/include/asm-x86/cpufeature.h
+++ b/xen/include/asm-x86/cpufeature.h
@@ -169,6 +169,7 @@
 /* Intel-defined CPU features, CPUID level 0x00000007:0.edx, word 9 */
 #define X86_FEATURE_IBRSB      (9*32+26) /* IBRS and IBPB support (used by 
Intel) */
 #define X86_FEATURE_STIBP      (9*32+27) /* STIBP */
+#define X86_FEATURE_ARCH_CAPS  (9*32+29) /* IA32_ARCH_CAPABILITIES MSR */
 
 /* An alias of a feature we know is always going to be present. */
 #define X86_FEATURE_ALWAYS      X86_FEATURE_LM
diff --git a/xen/include/asm-x86/msr-index.h b/xen/include/asm-x86/msr-index.h
index 1ef338e361..e5845a7871 100644
--- a/xen/include/asm-x86/msr-index.h
+++ b/xen/include/asm-x86/msr-index.h
@@ -40,6 +40,9 @@
 #define PRED_CMD_IBPB                  (_AC(1, ULL) << 0)
 
 #define MSR_ARCH_CAPABILITIES          0x0000010a
+#define ARCH_CAPABILITIES_RDCL_NO      (_AC(1, ULL) << 0)
+#define ARCH_CAPABILITIES_IBRS_ALL     (_AC(1, ULL) << 1)
+#define ARCH_CAPS_RSBA                 (_AC(1, ULL) << 2)
 
 /* Intel MSRs. Some also available on other CPUs */
 #define MSR_IA32_PERFCTR0              0x000000c1
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.6

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/xen-changelog

 


Rackspace

Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.